Rolling Rollout
Last updated on May 21, 2026
A rolling rollout splits a Deployment rollout into stages. Each stage pins the new build to a fraction of the Procedure's production Stations, and the remaining stations keep the previous deployment until you advance.
How it works
You define two or more stages. Each stage targets a fraction of stations and assigns the new deployment, and you advance through them manually. The final stage is always 100%.
Runs on canary and base stations are tagged with their deployment ID, so Analytics splits metrics by deployment.
| Stage | Typical fraction |
|---|---|
| Canary | 1 station, or ~10% of the fleet |
| Progressive | 25%–50% |
| Full | 100% |
Start a rollout
Follow these steps to launch a staged rollout from the dashboard.
Push a commit to the production branch, or promote a preview Deployment to production.
On the procedure's Deployments page, click the new deployment and select Start rolling rollout.
Define the stages.
Confirm. TofuPilot pins the new deployment to the canary stations, and every other production station keeps the previous deployment.
Watch the canary
While a rollout is active, the Deployments page shows live signals you can use to decide whether to advance:
- The current stage and the fraction of stations on the new build.
- First-pass yield for canary vs base.
- Average Run duration for both.
- Error and timeout rates for both.
The same metrics are available on Analytics, filtered by procedure and split by deployment ID.
Advance
When the canary looks healthy, move to the next stage.
On the active rollout banner, click Advance.
The next stage activates and more stations pick up the new deployment between runs.
The final stage completes the rollout. The deployment becomes active on every station, and the previous deployment becomes the rollback target.
Abort
When the canary looks bad, abort the rollout to revert canary stations.
On the active rollout banner, click Abort.
Confirm. Canary stations revert to the previous deployment on the next idle window between runs.
The aborted deployment stays in the registry, so you can inspect its logs, push a fix, and start a new rollout.
How is this guide?